[DragonFlyBSD - Bug #3438] (New) PF: does not reassemble IPv6 fragments

[sigttou]

Issue #3438 has been reported by sigttou.

----------------------------------------
Bug #3438: PF: does not reassemble IPv6 fragments
http://bugs.dragonflybsd.org/issues/3438

* Author: sigttou
* Status: New
* Priority: Normal
* Category: PF
* Target version: 6.6
* Start date: 2026-10-04
----------------------------------------
PF reassembles IPv4 fragments but filters IPv6 fragments as protocol 44
(the Fragment header), not the encapsulated protocol. Rules passing ICMPv6
by type or TCP/UDP by port therefore do not pass the corresponding fragments.
A broad pass rule can pass them, but does not enforce those restrictions.
`fragment reassemble` does not change this for IPv6.

This explains a separate large-ping failure seen while testing #3342, even
with IPv6 uRPF disabled. The normalization length fix does not add reassembly.

The attached man-page patch describes the current behavior. It does not
implement reassembly.

OpenBSD and FreeBSD PF have IPv6 reassembly code that could be reviewed for a
port. Alternatively, retain the limitation with explicit fragment policy.

---Files--------------------------------
0003-pf.conf.5-describe-IPv6-fragment-filtering-without-r.patch (1.42 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account